PT-2026-44426 · Casdoor · Casdoor
Published
2026-05-28
·
Updated
2026-05-28
·
CVE-2026-9097
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. Because the revocation check is entirely absent, administrators are unable to terminate active sessions or revoke compromised tokens.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Casdoor